feat(desktop): approved folder tools, Chromium-only images, and reliable Quit (S10)

[davidmckayv]

S10 lets a selected Bot use folders approved by the desktop owner. The native broker enforces Bot/actor/session grants; reads are read-only, writes preserve a backup, and writes or isolated offline commands require native approval. Revocation and Stop/Quit cancel access and work. The same signed server tools serve the app and Admin controls.

This also includes Chromium-only browser packaging, native Quit cleanup, and Windows Podman host routing. The Windows fix configures the owned VM before Compose, resolves the host address through its DNS, and reloads Podman's API only when that configuration changes. This follows Podman's documented WSL networking and API service lifecycle.

The review follow-up protects the additional developer credential stores, including both Cargo credential filenames and GitHub CLI’s documented Windows location. Windows system folders come from the process environment instead of a fixed C: drive. Both computer images copy Bun 1.3.14 from the same official multi-platform image pinned by SHA-256, following Docker’s digest-pinning guidance.

Validation of review follow-up 107a0667:

• All 20 CI checks passed on 107a0667, including native Windows/macOS/Linux builds and regressions, the Windows process-environment path test, and both image build checks with the deployment startup check.
• 14 host-access tests and 17 packaging tests pass, including denied credential roots/ancestors/children, allowed project folders, and relocated Windows locations. New regressions were observed failing before the fixes.
• Rust formatting/strict Clippy, Biome and explicit TypeScript checking pass.
• Both complete arm64 images build. Bun 1.3.14 launches Chromium and opens Example Domain as an unprivileged user in each final image; screenshots inspected.

Retained native end-to-end validation from 97cc3651:

• macOS: actual LangGraph graph/table and browser use; native folder grant/read, approved write with backup, command, deny/revoke and wrong-Bot refusal. Cmd-Q during a confirmed live command stopped the app, services and OpenBot containers within three seconds.
• Windows: actual browser use and a visually inspected line chart for CSV values Jan 120 / Feb 180 / Mar 240, returned by the real host_read_file callback. Native grant, approved write/backup, denied write unchanged, approved command and revoked-grant refusal passed.
• Windows native startup recreated the host configuration and the current agent container reached both host aliases with HTTP 200, without a firewall workaround. During actual native-menu Quit, a confirmed live 25-second command received SIGTERM after 0.614 seconds; Podman recorded exit 143 and removal. The app, three owned services and remaining OpenBot containers were gone within 27 seconds.
• Chromium runtime checks passed on arm64 and amd64. These checks do not claim that a Cloudflare challenge was bypassed.

The Windows visual run used the saved Qwen3-VL 2B/Ollama compatible endpoint. Its initial replies omitted tools or used incorrect chart arguments; the accepted run used an explicit line-chart request. Native approval, file effects, revocation and process termination were checked directly as well as through regression tests.

Closes FOR-302.

Merged into main with admin privileges on 2026-09-13 at David’s instruction. Merge commit: 1d4490aa198ce2eacf722b3e475a5a56d9b5f59f.

[linear-code]

FOR-302